wpForo SQL Injection Vulnerability in Topics ORDER BY Clause

A SQL injection vulnerability has been identified in the wpForo WordPress plugin, specifically in version 2.4.14. The issue arises in the Topics::get_topics() function, where the ORDER BY clause is vulnerable to injection attacks. This vulnerability is due to inadequate sanitization of unquoted identifiers, allowing attackers to exploit the wpfob parameter with CASE WHEN payloads. This exploitation enables blind boolean extraction of credentials from the WordPress database.

Impact

Exploitation of this vulnerability allows for unauthenticated SQL injection, with the potential for blind boolean-based extraction of data, such as user credentials, from the WordPress database.